authgear / authgear/authgear-server
[Whatsapp OTP] Error message when Double Login from 2 different browsers
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
bug/minor
## Background:
- Device / Browser (OS version): Chrome on Mac
- Build: Version tag 2022-05-11.0
## Description:
Error message when Double Login from 2 different browsers, one of the browser will show error message `code web session id doesn't match current web session id`
## Steps to reproduce:
1. [Browser A] Login with phone number
2. [Browser B] Login with the same phone number
3. In Whatsapp, send 2FA from browser A
4. See browser B said `You have entered a wrong code.`
5. [Browser A] Under "Do you want to resend it?", click Refresh, see error message `code web session id doesn't match current web session id`
6. In Whatsapp, send 2FA from browser B
7. See Browser B successfully logged in
8. [Browser A] Under "Do you want to resend it?", click Refresh, see error message gone, 2FA still the same
9. In Whatsapp, send 2FA from browser A
10. See Browser A still not logged in, but 2FA won't update anymore
## Expected result:
Provide clearer error message when there are 2 concurrent web session.
If the app don't support multiple login, kick the first login out, i.e. Browser A
If the app support multiple login, find ways to let them both login, find ways to tell browser A that the first 2FA is no longer valid and issue new 2FA.
## Screenshot:
Left Browser A, Right Browser B
https://user-images.githubusercontent.com/4337525/172125168-7dc6c00b-7a54-46d1-ac96-9f50abfe4cfe.mp4
Contributor guide
Research direction
Start by reproducing the two-browser WhatsApp OTP sequence described in the issue and trace the web-session and 2FA flow that produces the session-mismatch error. First clarify whether concurrent logins are supported; done means the chosen behavior is implemented, the affected browser receives a clear message, and the stale 2FA code cannot leave either login stuck.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100